{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-15T20:55:49.054","vulnerabilities":[{"cve":{"id":"CVE-2026-25484","sourceIdentifier":"security-advisories@github.com","published":"2026-02-03T19:16:25.877","lastModified":"2026-02-10T18:13:04.970","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. This issue has been patched in versions 4.10.1 and 5.5.2."},{"lang":"es","value":"Craft Commerce es una plataforma de comercio electrónico para Craft CMS. En las versiones desde la 4.0.0-RC1 hasta la 4.10.0 y desde la 5.0.0 hasta la 5.5.1, existe un XSS Almacenado a través de los nombres de los Tipos de Producto. El nombre no se sanea cuando se muestra en la configuración de permisos de usuario. La entrada vulnerable (fuente) está en Commerce (configuración de Tipos de Producto), pero el sumidero está en la configuración de permisos de usuario de CMS. Este problema ha sido parcheado en las versiones 4.10.1 y 5.5.2."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*","versionStartIncluding":"4.0.1","versionEndExcluding":"4.10.1","matchCriteriaId":"6EFA9347-254D-4D9E-84B1-8C0FFCC377F9"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_commerce:*:*:*:*:*:craft_cms:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.5.2","matchCriteriaId":"65ADAE4B-A19C-4FB1-AE39-8CF4AF57499B"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_commerce:4.0.0:-:*:*:*:craft_cms:*:*","matchCriteriaId":"2B409639-1C00-4E9C-950E-77058C40A5F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_commerce:4.0.0:rc1:*:*:*:craft_cms:*:*","matchCriteriaId":"E4B4BB43-0D60-4F6F-9F6F-1F7B3AF75EBA"}]}]}],"references":[{"url":"https://github.com/craftcms/commerce/commit/7e1dedf06038c8e70dce0187b7048d4ab8ffb75c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/craftcms/commerce/releases/tag/4.10.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/craftcms/commerce/releases/tag/5.5.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/craftcms/commerce/security/advisories/GHSA-2h2m-v2mg-656c","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}